list_item_verbose in tar/util.c in libarchive through 3.7.7 does not check an strftime return value, which can lead to a denial of service or unspecified other impact via a crafted TAR archive that is read with a verbose value of 2. For example, the 100-byte buffer may not be sufficient for a custom locale.
CVSS Details
- CVSS 3.1 Base Score: 4
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade bsdtarUpgrade libarchiveUpgrade libarchive-devel | Jul 1, 2025 | Mar 2, 2025 |
| Alpine Linux | — | Upgrade libarchive | Aug 8, 2025 | Mar 2, 2025 |
| Debian | — | No solution exists | May 15, 2025 | Mar 2, 2025 |
| Huawei Euleros 2_0_sp10 | — | Upgrade libarchive | Jul 11, 2025 | Mar 2, 2025 |
| Huawei Euleros 2_0_sp11 | — | Upgrade libarchive | Jun 13, 2025 | Mar 2, 2025 |
| Huawei Euleros 2_0_sp12 | — | Upgrade libarchive | Jun 11, 2025 | Mar 2, 2025 |
| Huawei Euleros 2_0_sp13 | — | Upgrade libarchive | Jul 1, 2025 | Mar 2, 2025 |
| Nutanix Ahv | — | Upgrade Nutanix AHV to the latest version | Jun 5, 2026 | Dec 15, 2025 |
| Oracle_linux | — | Upgrade bsdtarUpgrade libarchive-develUpgrade libarchive | Jun 30, 2025 | Mar 2, 2025 |
| Redhat_linux | — | No solution existsUpgrade libarchive-debugsourceUpgrade bsdtarUpgrade libarchive-develUpgrade libarchiveUpgrade libarchive-debuginfoUpgrade bsdunzip-debuginfoUpgrade bsdtar-debuginfoUpgrade bsdcpio-debuginfoUpgrade bsdcat-debuginfo | Jun 26, 2025 | Mar 2, 2025 |
| Rocky_linux | — | Upgrade libarchiveUpgrade bsdtar-debuginfoUpgrade libarchive-debuginfoUpgrade libarchive-debugsourceUpgrade bsdtarUpgrade libarchive-devel | Oct 6, 2025 | Oct 4, 2025 |
| Suse | — | Upgrade bsdtarUpgrade libarchive-develUpgrade libarchive13Upgrade libarchive13-32bit | Dec 5, 2025 | Jun 26, 2025 |
| Ubuntu | — | Upgrade libarchive-tools (Ubuntu Pro)Upgrade bsdtar (Ubuntu Pro)Upgrade libarchive-toolsUpgrade libarchive13Upgrade libarchive13 (Ubuntu Pro)Upgrade bsdcpio (Ubuntu Pro)Upgrade libarchive-dev (Ubuntu Pro)Upgrade libarchive13t64Upgrade libarchive-dev | Apr 24, 2025 | Mar 2, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jul 2, 2025 | Mar 2, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub